tag
Ipv6
CVE-2026-41285
network
HIGH
OpenBSD slaacd/rad Infinite Loop via Malformed ND Option (CVE-2026-41285)
slaacd and rad each contain their own userland parser for ICMPv6 Neighbor Discovery (ND) options, separate from the kernel's already-correct nd6options() validation. Their parsing loop computes optlen = ndoptlen 8 - 2, and when an attacker sends an ND option…
Patched
2026-07-05
None assigned as of 2026-07-03
network
LOW
Nmap IPv6 Extension-Header Length Wrap
The Nmap IPv6 extension-header parser in libnetutil/netutil.cc advances a payload pointer by an attacker-declared extension-header length without first checking that the advanced pointer stays within the bounds of the captured packet. When a crafted,…
Unverified
2026-07-03